My application is currently undergoing security review (AppExchange submitting) and has been reported with the 'Insecure Storage of Sensitive Data' issue related to the following line of code.

private static final String YOUTUBE_DATA_API_KEY = 'xxxxxxxx';

How do we store the API key (YOUTUBE_DATA_API_KEY) to pass 'Insecure Storage of Sensitive Data'?

p/s: My desired solution is that users don't have to set up their API keys but can use ours.

2 Answers 2


If this API key never changes, the best way to package it is to use protected custom metadata. Then, you can add the custom metadata record with your key to your package.

If customers can set the key, create a custom LWC where customers can enter the key. Store the key in a protected hierarchical custom setting at the org level. You could use custom metadata as well but that's much more complicated than using a custom setting. In case uou want to go for custom metadata, you need to use Apex Metadata, but a custom setting you can simple save using DML.

Just so you know, the LWC shouldn't show any saved values. Even obfuscating the key through a password field won't pass security review. Your LWC should check if the key is valid, store the key, and then let the user know the key has been successfully stored but not show it 'back' to the user.

In any case, the essence is that the key should be stored in a protected way and not in the open.


to store the API key securely, you can consider storing it in custom setting with protected mode. Since custom settings are also like objects, you can query that custom setting in your Apex code with the field that API key is stored and use it in the necessary place.

  • How can I package custom settings records (containing API keys) to the managed package? Commented Jan 26 at 8:07
  • I don't know if there is a way to package the record of custom setting. As an alternative, you can consider adding a post install script which is basically an apex class that runs when the package is installed and you can add the necessary method to that class to create the custom setting record with the API key stored inside. Please refer to the following link : developer.salesforce.com/docs/atlas.en-us.pkg1_dev.meta/… Also if this helped you please kindly click on the checkmark to mark the answer as accepted. Commented Jan 26 at 9:39
  • 3
    Protected custom settings have been replaced by protected custom metadata type records. The latter can be packaged, the former cannot.
    – Phil W
    Commented Jan 26 at 11:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .